Home / server / Questions / 575876
Accepted
Andrew Marshall
Asked: 2014-02-16 10:51:01 +0800 CST

Expanding a macro containing a subnet IP address with prefix (CIDR) in a list using PF firewall

  • 772

I’m trying to expand a macro that contains an address with a subnet mask into a list with PF like so:

subnet1 = "192.168.1.0/24"
subnet2 = "10.0.0.0/8"
subnets = "{" $subnet1 $subnet2 "}"

But this results in a syntax error on the last line:

/etc/pf.conf:3: syntax error

It works fine with non-subnet mask addresses:

ip1 = "192.168.1.0"
ip2 = "10.0.0.0"
ips = "{" $ip1 $ip2 "}"

I’m using PF from FreeBSD 10.0 (≈ PF from OpenBSD 4.5). How can I get this to work?

subnet

1 Answers

  1. Best Answer

    You have to quote the subnet mask addresses again (with single quotes) when defining:

    subnet1 = "'192.168.1.0/24'"
subnet2 = "'10.0.0.0/8'"
subnets = "{" $subnet1 $subnet2 "}"

    Sadly this doesn’t appear to be documented anywhere.

    • 3